LUFITOPrivate links between offices, partners and staff
The bank won’t connect you until there is a private line between you.
Lufito builds that line — and the next one, and the one after that, all from a single machine. Every partner, every branch and every member of staff is kept apart from all the others without anyone having to remember to.
Every company gets its own lane the moment you add it. The rules are written again from that list each time something changes, so a company that has not been given access to something simply cannot reach it — including by accident.
What it does
Three problems, one machine, no network department
Most businesses meet this sideways. A deal with a partner stalls on a technical requirement, staff cannot get at the office systems from home, or a piece of equipment turns out to be older than anyone realised.
A partner insists on a private line
Banks, insurers and payment companies will not send your business across the open internet. They post you a page of settings and expect you to match it exactly. Lufito answers that page — and the next partner’s page too, from the same machine.
Your people are not in the office
Laptops and phones join in about a minute, and a phone is set up by scanning a single code. A company server can be given a narrow path that reaches only what it needs, so nothing else about how it works has to change.
Equipment that cannot keep up
An old phone system or appliance that only speaks an outdated language still joins its owner’s network, under exactly the same rules as everything else. Nothing is let off for being old.
The part that matters
Sharing a machine should never mean sharing a network
The cheap way to put several companies on one machine is to drop them all onto the same network and hope nobody wanders. That works right up until it doesn’t, and then you hear about it from the client.
Lufito writes its rules again from the client list every single time. Each company has its own lane. A door exists only where you have opened one, and everything else meets a closed one.
Traffic to a partner is checked twice more: once for what you are allowed to start with them, and once for what they are allowed to start with you. Both lists are empty until somebody adds a line, so a brand new connection carries nothing at all until you say what it may carry.
One consequence is worth saying plainly. If part of the client list cannot be read, the devices on it are simply missing from the rules — and missing means shut out. A fault costs somebody a connection. It never costs you the separation.
- Company A reaching Company A’s own thingsallowed
- Company B reaching Company B’s own thingsallowed
- Company A using Company A’s own line to its partnerallowed
- Company B using Company B’s own line to its partnerallowed
- Company A reaching anything belonging to Company Brefused
- Anything at all that is not on this listrefused
For your IT people
The specifics, for whoever runs your network
The rest of this page is in plain English on purpose. This part is not, because the person who has to approve it will want the details — and so will your partner’s engineers.
Site to site
- Protocol
- IKEv2, strongSwan
- Phase 1
- AES-256, SHA-256, DH group 14
- Phase 2
- ESP, AES-256, SHA-256, PFS
- Per tunnel
- own interface, own address, own rules
- Dead peers
- detected and restarted
Remote access
- Protocol
- WireGuard, dual stack
- Setup
- one QR code, or a config file
- Servers
- split tunnel, only the routes they need
- Fallback
- OpenVPN for appliances
- Revocation
- immediate, per device
Operating it
- Console
- web, reachable only over the VPN
- Accounts
- per client, scoped server-side
- Passwords
- scrypt, sessions revocable
- Record
- every change, with who and when
- Also
- a command line that does everything
Nothing proprietary and no vendor extensions — standard IKEv2 with settings that mainstream equipment already accepts, so the far end does not have to be Lufito too.
Where it runs
On your machine, with your keys
Lufito installs onto an ordinary Ubuntu machine — your own hardware, or a rented one from any provider you like. There is no Lufito service sitting in the middle, no account of ours that you depend on, and nobody else holding the keys to your partners.
The installer would rather stop than guess. It will not run on a machine that cannot do the job, and it will not take a set of addresses that clashes with something you are already using.
If you would rather not run it yourself, Sihebs will run it for you on exactly the same terms.
- We check the machine can do the jobAnd say so plainly if it cannot, rather than leaving you half installed and guessing.
- We check the addresses are freeNothing gets taken that something in your business is already using.
- We open only the doors that are neededThree of them, and the rest of the machine stays shut.
- You add your first clientOne line, and that client has its own lane with nothing else in it.
Who it is for
Businesses with partners, not network departments
Microfinance and lending
Links to core banking, connections to a credit bureau, and a branch network that has to reach both without either one seeing the other.
Health and insurance
Claims handled with several funds at once, where each one expects a private line of its own and its own conditions attached to it.
Call centres
Phone systems that have to reach a customer’s systems, and agents who need the office network from wherever they happen to be working.
Anyone asked to connect to a bank
If a page of settings has landed in your inbox and nobody in the building knows what to do with it, this is the shortest way to answer it.
Tell us who you need to reach
Send us the page of settings your partner gave you, or just describe the problem in your own words. We will tell you what it takes — including when the answer is that you don’t need us at all.
- info@sihebs.co.tz
- Phone
- +255 756 532 635
- +255 796 296 796
- Web
- www.sihebs.co.tz
Victoria House, 5th Floor, Wing B
Plot 37, Regent Estate, New Bagamoyo Road
P. O. Box 33073, Dar es Salaam, Tanzania